Client Name
              
                * 
              
             
          
                
                
                  
                     
                    First Name 
                   
                
                
                  
                     
                    Last Name 
                   
                
               
            
            
            
            
            
            
        
          
          
            
            
            
            
            
              
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
        
          
          
            
            
              
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
        
          
          
            
            
              
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
            
            
            
            
            
            
            
            
              
                
            
              Motivation to undergo the project: 
              
             
          
                
                
                  Client requirement (existing or prospective)
                
                  Legal/Regulatory - required in order to operate in the space
                
                  To expand my business (for example, product security)
                
                  To improve information security in the business
                
               
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
              
                
            
              Other:
              
             
          
                
                
              
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
            
            
            
            
            
            
            
            
              
                
            
              Is there a documented project mandate from executive management / board of directors to undergo ISO 27001:2022 certification?
              
             
          
                
                
                  Yes
                
                  No
                
                  In progress currently
                
               
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
              
                
            
              Other:
              
             
          
                
                
              
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
            
            
            
            
            
            
            
            
              
                
            
              Capacity planning for ISO 27001:2022 implementation
              
             
          
                
                
                  We have technical resources (staff, project members) already in place ready to implement
                
                  We have non-technical resources (ie HR, legal, operations) already in place ready to support
                
                  There is a set budget for implementing this project that will for up to 12 months
                
                  We do not know the current capacity yet
                
               
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
              
                
            
              Other:
              
             
          
                
                
              
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
            
            
            
            
            
            
            
            
              
                
            
              What process and set up do you have currently for a management system?
              
             
          
                
                
                  An information management system is in place but not ISO 27001 certified
                
                  Some processes or documentation is in place that can be used for the ISMS
                
                  No to little processes or documentation in place
                
                  We have a compliant management system, seeking ISO 27001:2022 upgrade
                
               
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
              
                
            
              Other:
              
             
          
                
                
              
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
            
            
            
            
            
            
            
            
              
                
            
              If you have information management system in place, what is the status?
              
             
          
                
                
                  Some procedures, processes, checklists written, no version control and it might be out of date
                
                  We have procedures, processes, checklists written, these are in daily use and kept up to date.
                
                  Ad hoc documents are written and updated for internal use, documents that are client facing are prioritised
                
                  We have a compliant management system, seeking ISO 27001:2022 upgrade
                
               
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
              
                
            
              Other:
              
             
          
                
                
              
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
            
            
            
            
            
            
            
            
              
                
            
              How flexible is your company in adopting new processes, procedures, policies, and standards? Please answer this for the entire company and not just the project team
              
             
          
                
                
                  Multiple Stakeholders - changes and new ventures require additional buy-in and negotiations
                
                  Agile - changes are readily moved into the queue for review and acceptance, and open to feedback
                
                  Lean out (very flexible) - Just tell us what to do and we will do it (within our budget for purchases)
                
               
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
              
                
            
              Other:
              
             
          
                
                
              
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
            
            
            
            
            
            
            
            
              
                
            
              Do you have a data protection management programme?
              
             
          
                
                
                  Yes and it is integrated with our current processes/system in place
                
                  Yes but mainly used by legal teams
                
                  No but we keep track of data protection requirements in some way
                
                  None
                
               
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
              
                
            
              Other:
              
             
          
                
                
              
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
            
            
            
            
            
            
            
            
              
                
            
              Do you have a dedicated person or team for any of the following roles/responsibilities
              
             
          
                
                
                  DPO (Data Protection Officer) - this is the person that reviews DPA, manages the data protection programme, privacy contact
                
                  SO (Information Security Officer) - this is the person that will end up managing the information security management system
                
                  Shared responsibility between employees
                
                  DPO is outsourced
                
                  ISO is outsourced or MSSP is used
                
               
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
              
                
            
              Other:
              
             
          
                
                
              
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
            
            
            
            
            
            
            
            
              
                
            
              What is your current IT team setup?
              
             
          
                
                
                  In-house dedicated employees
                
                  Contractors or vendors with SLA, NDA, job/task/scope description.
                
                  Contractors or vendors with NDA and simple or generic job/task description
                
                  MSSP
                
                  Mix of employees and outsourced
                
               
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
              
                
            
              Other:
              
             
          
                
                
              
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
        
          
          
            
            
            
            
            
            
            
            
            
            
            
            
              
                
            
              By filling in this form, you agree to be contacted by an authorized representative of Superuser for follow up to the questionnaire.  Your questionnaire answers will only be used as part of the internal client onboarding process-matching and will not be used for information filled in for other parties, such as auditing bodies.  
              
                * 
              
             
          
                
                
                  I Agree
                
               
            
            
            
            
            
            
            
            
        
         
      
      
      Thank you for putting your trust into Superuser OÜ and sharing us some insights into your information security management system.  This information will be used to compile a custom gap analysis report.
We understand that this some things may have changed or you may have missed some information.  Don’t worry.  Should there be updates after the form submission please contact your Account Manager / vCISO.
Please note that this analysis does not replace an internal audit programme.